Skip to main content

ISMS Scope (ISO 27001:2022 clause 4.3)

Document ID: isms-scope
Version: 1.0
Effective from: 2025-01-01
Owner: ISMS owner
Review cycle: Annual

note

This document is aligned to ISO/IEC 27001:2022 Annex A as a self-assessment. SigmaShake holds no ISO 27001 certification.

Scope statement​

The SigmaShake Information Security Management System covers the design, development, operation, and delivery of the SigmaShake governance-as-code platform, including all supporting infrastructure, data processing, and customer-facing services operated by SigmaShake.

In-scope systems​

The canonical list is shared/compliance-lib/system-description.ts. It shows 44 services in scope and 21 out of scope. This table follows that list as of 2026-10-12. If the two differ, the canonical list is correct.

SystemSurface
sigmashake-webCloudflare Workers
sigmashake-docsCloudflare Pages
sigmashake-trustCloudflare Workers
sigmashake-securityCloudflare Workers
sigmashake-statusCloudflare Workers
sigmashake-hubCloudflare Workers
sigmashake-mcpCloudflare Workers
sigmashake-buildCloudflare Workers
sigmashake-ssoCloudflare Workers
sigmashake-accountsCloudflare Workers
sigmashake-stripeCloudflare Workers
sigmashake-supportCloudflare Workers
sigmashake-emailerCloudflare Workers
sigmashake-calendarCloudflare Workers
sigmashake-discordCloudflare Workers
sigmashake-fleetCloudflare Workers
sigmashake-analyticsCloudflare Workers
sigmashake-canaryCloudflare Workers
sigmashake-secretsCloudflare Workers
sigmashake-alertsCloudflare Workers
sigmashake-complianceCloudflare Workers
sigmashake-downloadCloudflare Workers
sigmashake-desktop-linuxDesktop binary
sigmashake-voiceDesktop binary
sigmashake-navi-elixirDesktop binary
sigmashake-askCloudflare Workers
sigmashake-betsCloudflare Workers
sigmashake-navi-cacheCloudflare Workers
sigmashake-abyssCloudflare Workers
sigmashake-affiliatesCloudflare Workers
sigmashake-break-the-botCloudflare Workers
sigmashake-clipboardCloudflare Workers
sigmashake-meteringCloudflare Workers
sigmashake-modcontrolCloudflare Workers
sigmashake-observCloudflare Workers
sigmashake-redactorCloudflare Workers
sigmashake-salesCloudflare Workers
sigmashake-socCloudflare Workers
sigmashake-streamcordCloudflare Workers
sigmashake-twitch-eventsCloudflare Workers
sigmashake-vaultCloudflare Workers
sigmashake-vcsCloudflare Workers
sigmashake-workspaceCloudflare Workers
sigmashake-vibeCloudflare Workers

Out-of-scope systems​

These 21 services are out of scope: sigmashake-chatter-archive, sigmashake-mmo-wiki, sigmashake-stripe-production (a production deployment alias of the in-scope sigmashake-stripe; evidence is captured under the in-scope entry), sigmashake-playground, sigmashake-siem, sigmashake-arcade, sigmashake-ballz, sigmashake-chrome, sigmashake-derby, sigmashake-donations, sigmashake-follow, sigmashake-scarymaze, sigmashake-mediashare, sigmashake-news, sigmashake-podcast, sigmashake-promo, sigmashake-society, sigmashake-threats, sigmashake-voice-relay, sigmashake-guild and sigmashake-only (both launched after the observation-window start; review for the next period).

Also out of scope:

  • Customer-managed infrastructure (customers' own repositories, CI/CD pipelines)
  • Third-party SaaS used in a read-only or browser-only capacity (Slack, GitHub.com UI)

Physical boundary​

SigmaShake operates exclusively on cloud infrastructure (Cloudflare, GitHub). There are no on-premises data centres, office servers, or physical production systems. Physical security controls are inherited from cloud vendors (see A.7 Physical controls in SoA).

Organisational boundary​

Information security ownership rests with the designated ISMS owner. The ISMS owner is responsible for security decisions, controls, and evidence collection.

Applicability notes​

A.5.3 Segregation of duties is applicable and is addressed through compensating controls documented in the Statement of Applicability: Ed25519-signed compliance evidence objects and manifest roots, automated evidence collection, and review by external tooling. Branch-protection settings are recorded daily; whether branch protection is enforced is unverified. The ISMS owner approves changes; review is by external tooling; independent review is not performed today. The shipped ssg signs no local audit rows: local audit logging is best effort and unsigned. (Dated note 2026-10-13: wording corrected to match the Statement of Applicability.)

This document is managed in sigmashake-compliance isms_documents and its hash is recorded at ISMS registration.